Mass acceptance of the keyword scanning in Google's new e-mail service could leave government spooks feeling lucky.
If a computer programmed by people learns the contents of a communication, and takes action based on what it learns, it invades privacy.
The Gmail advertising concept is simple. When you log into the Gmail to retrieve and view your e-mail, the service automatically scans the contents of the email and displays a relevant ad on the screen for you to see. Although it has been said that neither Google nor the advertiser "knows" the text or essence of the e-mail message, this is not strictly true: if you click on the link to the ad, it can be reasonably inferred that the text of the e-mail in some way related to the advertiser's service.
Moreover, like any e-mail provider, the text of your Gmail is stored and subject to subpoena. I can envision a situation where an advertiser, paying Google hundreds of thousands of dollars, claims that Google failed to "insert" its ads in relevant e-mails, or inserted a competitor's ads instead (or in addition to, or more prominently). In the course of the ensuing litigation, wouldn't both the ads themselves and the text of the messages into which they were inserted be relevant, and therefore discoverable? I can't imagine why not.
But perhaps the most ominous thing about the proposed Gmail service is the often-heard argument that it poses no privacy risk because only computers are scanning the e-mail. I would argue that it makes no difference to our privacy whether the contents of communications are read by people or by computers programmed by people.
My ISP offers spam filtering, spyware blocking and other filtering of e-mail (with my consent) based at least partially on the content of these messages. Similarly, I can consent to automated searches of my mail to translate it into another language or do text-to-speech, or to strip HTML or executables. All these technologies examine the contents of mail sent to me. This certainly seems to suggest that an automated search of the contents of e-mail, with the recipient's consent, is readily tolerated. But is it legal?
The answer is not so simple. California Penal Code, Section 631 makes it a crime to "by means of any machine, instrument, or contrivance, or in any other manner, ... willfully and without the consent of all parties to the communication, ... learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state; or [to] use, or attempt to use, in any manner, or for any purpose, or to communicate in any way, any information so obtained."
So, if I send a mail to a Gmail user (let's assume I don't know anything about Gmail, and therefore can't be said to have "consented" to the examination) and Google's computers learn the meaning of the message without my consent, this action theoretically violates the California wiretap law. Google is based in California, but it's worth noting that other states, like Maryland, Illinois, Florida, New Hampshire and Washington State, also have so-called "all party consent" provisions that may also preclude this conduct.
To avoid these draconian provisions, Google will likely argue that its computers are not "people" and therefore the company does not "learn the meaning" of the communication. That's where we need to be careful. We should nip this nonsensical argument in the bud before it's taken too far, and the federal government follows.
Don't Be Echelon
Thus, the government believed that the "interception" did not occur when the computer analyzed the packets, read their contents, and flagged them for human viewing. Rather, the government believed that only human reading impacted a legitimate privacy interest. The U.S. Attorney went on to state, "This is a case of cyber-sleuthing, a glimpse of what computer crime fighting will look like in the coming years. We have made enormous strides in developing the investigative tools to track down individuals who misuse these vital computer networks." Then-Attorney General Reno added that the process of having computers analyze the intercepted messages was an appropriate balance because, "We are using a traditional court order and new technology to defeat a criminal, while protecting individual rights and Constitutional principles that are important to all Americans."
But imagine if the government were to put an Echelon-style content filter on routers and ISPs, where it examines billions of communications and "flags" only a small fraction (based upon, say, indicia of terrorist activity). Even if the filters are perfect and point the finger only completely guilty people, this activity still invades the privacy rights of the billions of innocent individuals whose communications pass the filter.
Simply put, if a computer programmed by people learns the contents of a communication, and takes action based on what it learns, it invades privacy.
Google may also argue that its computers do not learn the contents of the message while in transmission but only contemporaneously with the recipient, making wiretap law inapplicable. That argument, while technically accurate, is somewhat fallacious. If taken to its logical extreme, electronic communications are never intercepted in transmission. The packets must be stopped to be read.
Fundamentally, we should treat automated searches of contents as what they are: tools used by humans to find out more about what humans are doing, and provide that information to other humans. At least until the computers take over.